Academic work on honeypots and deception are often kinda disappointing, but this paper by @debi_ashenden and Reeves is worth the skim (especially since it confirms lots of our @ThinkstCanary takes 😉)
1) It's worth noting that the SolarWinds build environment was compromised months before the effects of it were discovered. (This is painfully consistent)
1/12
2) Instead of the attackers modifying the SolarWinds source code, they modified the build environment to insert their back door. This may be a nod to the classic "Reflections on Trusting Trust" paper¹, but is more likely because it's stealthier.
3) @smc90 mentioned goosebumps a few times at the parallels between the attackers activity and modern dev practices. This is perfectly par. Software -cough- is eating the world and this is just a professional remote software project.